Security
Built to protect what matters.
Trust is the product. The Talent Platform is engineered so that privacy and access controls hold even under mistake or misuse — enforced in the database, not just the UI.
Access control at every layer
Authorization is enforced on the server and independently in the database via row-level security — not just hidden in the interface. A user can only ever reach the data and actions their role permits.
Tenant isolation
Employer data is isolated by organization. One employer can never see another's applicants, notes, or analytics, even by manipulating a URL or identifier.
Private documents
Resumes and uploaded documents live in private storage. Employer access to a candidate's resume is time-limited, server-signed, and recorded in an access log.
Least privilege
Each account receives the minimum permissions required. CEFA staff hold only the specific modules an administrator grants them — nothing by default.
Auditability
Sensitive actions — approvals, role and permission changes, status changes, resume access, and administrative operations — are written to an append-only audit log.
Account protection
Strong password hashing, secure session cookies, session invalidation on password change or role removal, and rate limiting on sensitive endpoints. MFA is available for staff and administrators.
Data handling
- Encryption in transit (HTTPS) across the platform.
- Input validation and sanitization at every system boundary.
- Non-sequential public identifiers to prevent enumeration.
- Uploads validated by type, size, and scanned before storage.
- Security headers, CSRF protections, and abuse controls on forms.
Report a vulnerability
If you believe you've found a security issue, please report it responsibly through our Report a Problem page. We investigate security reports as a priority and appreciate coordinated disclosure.